{"id":"CVE-2026-93517","kind":"vulnerability","aliases":["CVE-2026-93517"],"related":[],"title":"X.org X server: GLX heap overflow lets an authenticated client run code","description":"A heap buffer overflow in handling GLX\nRenderLarge request where dataBytes exceeds cmdlen in X.org X server before 21.1.25 and XWayland before 24.1.14 that could be be triggered by an authenticated X client could cause crashes or code execution in X server context.","summary":"A heap buffer overflow in the GLX RenderLarge request handling of the X.org X server and XWayland lets an authenticated X client crash the server or execute code in its context. Affected versions are X.org X server before 21.1.25 and XWayland before 24.1.14.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bsd","desktop","infrastructure","linux","xorg","xwayland"],"not_affected_if":["no-x-server","patched-version","wayland-only-no-xwayland"],"how_to_check":"- Run `Xorg -version` or `X -version` and compare against `21.1.25`\n- Run `Xwayland -version` and compare against `24.1.14`\n- Check which package provides the X server with `dpkg -l xserver-xorg-core` or `rpm -q xorg-x11-server-Xorg`","fix":"- Upgrade X.org X server to `21.1.25` or later\n- Upgrade XWayland to `24.1.14` or later\n- Apply the distribution's X server security update where a fixed backport is shipped","status":"open","published_at":"2026-10-28T14:17:08+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","triaged_at":"2026-10-28T14:34:21+00:00","updated_at":"2026-10-28T14:34:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T14:34:21Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade X.org X server to `21.1.25` or later\n- Upgrade XWayland to `24.1.14` or later\n- Apply the distribution's X server security update where a fixed backport is shipped","reach":"local","title":"X.org X server: GLX heap overflow lets an authenticated client run code","impact":"high","summary":"A heap buffer overflow in the GLX RenderLarge request handling of the X.org X server and XWayland lets an authenticated X client crash the server or execute code in its context. Affected versions are X.org X server before 21.1.25 and XWayland before 24.1.14.","category":"infrastructure","nicknames":[],"who_cares":["linux","xorg","xwayland","desktop","bsd"],"confidence":0.6,"needs_auth":"yes","worst_case":"Code runs in the X server context, or the server crashes","analyst_note":"Confirm whether the GLX RenderLarge trigger is reachable by any authenticated client by default and check distribution backport versions via the NVD entry and X.org advisory.","how_to_check":"- Run `Xorg -version` or `X -version` and compare against `21.1.25`\n- Run `Xwayland -version` and compare against `24.1.14`\n- Check which package provides the X server with `dpkg -l xserver-xorg-core` or `rpm -q xorg-x11-server-Xorg`","needs_analyst":true,"not_affected_if":["no-x-server","wayland-only-no-xwayland","patched-version"],"who_is_affected":"Systems running an X.org X server older than 21.1.25 or an XWayland older than 24.1.14, including desktop Linux and BSD sessions and Wayland compositors that spawn XWayland. Exposure needs an X client that can authenticate to the server, so single-user machines with no other X clients are at lower risk. Hosts that run no X server and no XWayland can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3319,"output_tokens":684,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-93517':15A,18A '21.1.25':63B,86C '24.1.14':67B,90C 'affect':56B 'authent':9A,44B,98C 'bsd':19B 'buffer':27B,70C 'caus':102C 'client':10A,46B,100C 'cmdlen':80C 'code':12A,52B,105C 'context':55B,110C 'could':92C,101C 'crash':47B,103C 'cve':13A,16A 'databyt':78C 'desktop':20B 'exceed':79C 'execut':51B,106C 'glx':4A,31B,74C 'handl':34B,73C 'heap':5A,26B,69C 'infrastructur':21B 'let':7A,42B 'linux':22B 'overflow':6A,28B,71C 'renderlarg':32B,75C 'request':33B,76C 'run':11A 'server':3A,39B,49B,61B,84C,109C 'trigger':95C 'version':57B 'x':2A,38B,45B,60B,83C,99C,108C 'x.org':1A,37B,59B,82C 'xorg':23B 'xwayland':24B,41B,65B,88C","nicknames":[],"mitigations":[],"who_affected":"Systems running an X.org X server older than 21.1.25 or an XWayland older than 24.1.14, including desktop Linux and BSD sessions and Wayland compositors that spawn XWayland. Exposure needs an X client that can authenticate to the server, so single-user machines with no other X clients are at lower risk. Hosts that run no X server and no XWayland can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"meissner@suse.de","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-93517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93517","severity":null,"published_at":"2026-10-28T14:17:08+00:00","modified_at":"2026-10-28T14:17:08+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","fetched_at":"2026-10-28T14:33:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}